Edit report at https://bugs.php.net/bug.php?id=79046&edit=1
ID: 79046
Updated by: nikic@php.net
Reported by: wxhusst at gmail dot com
Summary: NaN to int cast undefined behavior in exif
-Status: Verified
+Status: Closed
Type: Bug
Package: EXIF related
Operating System: linux
PHP Version: 7.4.1
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of nikita.ppv@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d1537e506edb48790c72a93e1d8505ef2c3e4dd3
Log: Fixed bug #79046
Previous Comments:
------------------------------------------------------------------------
[2019-12-30 15:29:21] nikic@php.net
This was partially addressed in https://github.com/php/php-src/commit/dd997a40d0be9b03973b1317041f92ad9582237f,
but the NaN case wasn't handled.
Reclassifying as normal bug as this UBSan violation does not result in an actual miscompile.
------------------------------------------------------------------------
[2019-12-30 03:37:32] wxhusst at gmail dot com
Description:
------------
exif_read_data may lead to integer overflow
raven@ubuntu ~/p/s/cli (master)>
./php -r
'exif_read_data("/home/raven/php-src/crash-7cd841466926b2ce76d75b379568282a0fc8914b",
"IFD0");'
/home/raven/php-src/ext/exif/exif.c:1677:10: runtime error: nan is outside the range of
representable values of type 'unsigned long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/raven/php-src/ext/exif/exif.c:1677:10
in
sorry, no backtrace for gdb
the file
https://github.com/loveraven42/poc/blob/master/crash-7cd841466926b2ce76d75b379568282a0fc8914b
Test script:
---------------
./php -r
'exif_read_data("/home/raven/php-src/crash-7cd841466926b2ce76d75b379568282a0fc8914b",
"IFD0");
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=79046&edit=1